Stephen Northcutt and coauthors note in the superb Network Intrusion Detection that there's really no such thing as an attack that's never been seen before. The book documents scores of attacks on systems of all kinds, showing exactly what security administrators should look for in their logs and commenting upon attackers' every significant command. This is largely a taxonomy of hacker strategies and the tools used to implement them. As such, it's an essential tool for people who want to take a scientific, targeted approach to defending information systems. It's also a great resource for security experts who want to earn their Certified Intrusion Analyst ratings from the Global Incident Analysis Centre (GIAC)--it's organised, in part, around that objective.
The book typically introduces an attack strategy with a real-life trace--usually attributed to a real administrator--from TCPdump, Snort or some sort of firewall (the trace's source is always indicated). The trace indicates what is happening (i.e. what weakness the attacker is trying to exploit) and the severity of the attack (using a standard metric that takes into account the value of the target, the attack's potential to do damage, and the defences arrayed against the attack). The attack documentation concludes with recommendations on how defences could have been made stronger. These pages are great opportunities to learn how to read traces and take steps to strengthen your systems' defences.
The book admirably argues that security administrators should take some responsibility for the greater good of the Internet by, for example, using egress filtering to prevent people inside your networks from spoofing their source address (thus defending other networks from your own users' malice). The authors (and the community of white-hat security specialists that they represent) have done and continue to do a valuable service to all Internet users. Supplement this book with Northcutt's excellent Network Intrusion Detection, which takes a more general approach to log analysis, less focused on specific attack signatures. --David Wall
Intrusion Signatures and Analysis opens with an introduction into the format of some of the more common sensors and then begins a tutorial into the unique format of the signatures and analyses used in the book. After a challenging four-chapter review, the reader finds page after page of signatures, in order by categories. Then the content digs right into reaction and responses covering how sometimes what you see isn¿t always what is happening. The book also covers how analysts can spend time chasing after false positives. Also included is a section on how attacks have shut down the networks and web sites of Yahoo, and E-bay and what those attacks looked like. Readers will also find review questions with answers throughout the book, to be sure they comprehend the traces and material that has been covered.See all Product Description
I read this book out of general interest and a need to dig deeper into the technical aspects of security, and intrusion detection in particular. Read morePublished on July 10 2001 by R. Esser
This is the second release from some of the key SANS GIAC folk and is a fine addition as it extends on the data from "Network Intrusion Detection : An Analysts... Read morePublished on April 5 2001 by Garry Coldwells Intrusion.com
"Intrusion Signatures and Analysis" is a handy companion volume to "Network Intrusion Detection, 2nd Ed. Read morePublished on Feb. 5 2001 by Erik Fichtner